Data encryption and decryption method and system

Abstract

The invention relates to a data encryption and decryption method and system, and the method comprises the steps: carrying out the encryption of to-be-encrypted data through a dynamic original key, carrying out the encryption of the dynamic original key through all first keys obtained from a key management platform, and obtaining a first target key, selecting a first number of first keys from all the first keys to perform a second number of combinations, encrypting the dynamic original key through each combined key to obtain a second target key, and decrypting the first target key through the first key if all key requests are answered when decrypting the encrypted data, and otherwise, decrypting the second target key according to a combined key obtained by combining the responded first keys, and decrypting the encrypted data through the decrypted target key to obtain the original data. Therefore, under the condition that the key management platform fails, the encrypted data can still be decrypted, and the reliability is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for data encryption and decryption. Background Art

[0002] The existing data encryption and decryption is generally that the central platform obtains data, encrypts the data using the encryption key obtained from the key management platform, and then stores the encrypted data. When the data needs to be used, the central platform initiates a request to the key management platform to obtain the encryption key, decrypts the encrypted data with the obtained encryption key, and then obtains the decrypted data. This method needs to rely on the key management platform, and the key management platform may fail due to business or other reasons. Therefore, there is a situation where the central platform cannot obtain the key to decrypt the data, resulting in the inability to decrypt the data. Summary of the Invention

[0003] The technical problem to be solved by the present invention is: the present invention provides a method and system for data encryption and decryption to improve the reliability of data encryption and decryption.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] In a first aspect, the present invention provides a method for data encryption and decryption, comprising:

[0006] Obtaining a dynamic original key, encrypting the data to be encrypted using the dynamic original key to obtain encrypted data, performing a hash calculation on the dynamic original key to obtain a first hash value, and storing the first hash value in the supervision platform;

[0007] Obtaining first keys from all key management platforms, and encrypting the dynamic original key using all the first keys to obtain a first target key;

[0008] Selecting a first number of first keys from all the first keys to perform a second number of combinations to obtain all combined keys, and encrypting the dynamic original key using each combined key to obtain all second target keys;

[0009] When decrypting the encrypted data, a key request is sent to all the key management platforms to determine whether all the key requests are responded to. If so, the first target key is decrypted according to the first key obtained from all the key requests to obtain the decrypted target key. If not, all the second target keys are decrypted according to the combined key obtained by combining the first keys obtained from the key requests to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value and a verification request is sent to the supervision platform to obtain the first hash value. It is determined whether the first hash value is the same as the second hash value. If so, the encrypted data is decrypted by the decrypted target key corresponding to the second hash value to obtain the original data.

[0010] The beneficial effects of the present invention are: encrypting the encrypted data by the dynamic original key. Since the original key is dynamic, it ensures that the back-end management personnel cannot directly use the original key to illegally decrypt and disclose the encrypted data, thereby ensuring the security of the encrypted data. When encrypting the dynamic original key, it is not only encrypted by the first key of all key management platforms, but also a first number of first keys are selected from all first keys to perform a second number of combinations, and the dynamic original key is encrypted by the obtained combined key. When decrypting the encrypted data, if all the first keys cannot be obtained from the key management platform, that is, if the key management platform fails or fails, the second target key can be decrypted by the combined key obtained by combining the first keys obtained from the responsive key management platform, and the encrypted data is decrypted with the decrypted target key corresponding to the second hash value that is the same as the first hash value of the dynamic original key, thereby obtaining the original data. The first hash value is obtained from the supervision platform, thereby ensuring the security of the first hash value, realizing decryption of the encrypted data, and improving the reliability of data encryption and decryption.

[0011] Optionally, the step of obtaining the dynamic original key includes:

[0012] Generate dynamic raw keys in a trusted execution environment.

[0013] According to the above description, the dynamic original key is generated in a trusted execution environment to ensure the security of the dynamic original key.

[0014] Optionally, generating a dynamic original key in a trusted execution environment includes:

[0015] A local physical key is obtained and a random number is generated, and a new dynamic original key is generated by superimposing the physical key and the random number on the dynamic original key through an encryption algorithm.

[0016] According to the above description, the final dynamic original key is a physical key and a random number superimposed on the original key, using a multiple encryption method to improve the security and flexibility of the dynamic original key.

[0017] Optionally, encrypting the dynamic original key using all of the first keys to obtain a first target key includes:

[0018] Encrypt the dynamic original key in sequence using each first key to obtain a first target key;

[0019] and / or

[0020] Superimposing all the first keys by an encryption algorithm to generate a new first key, and encrypting the dynamic original key by the new first key to obtain a first target key;

[0021] and / or

[0022] All the first keys are mutually encrypted by an encryption algorithm to obtain all encrypted first keys, and the dynamic original keys are encrypte d by all the encrypted first keys to obtain all first target keys.

[0023] According to the above description, the dynamic original key is encrypted in a diversified manner through all the first keys, which improves the flexibility of the first target key and the security of the first target key.

[0024] Optionally, selecting a first number of first keys from all the first keys to perform a second number of combinations to obtain all combined keys includes:

[0025] Substitute the first number and the second number into a combination formula to calculate all combination numbers, and obtain all combination keys based on all the combination numbers. The combination formula is:

[0026]

[0027] Wherein, P represents the number of all combinations, n represents the first number, and m represents the second number.

[0028] Optionally, the second number is (1, first number].

[0029] According to the above description, the number of combinations is calculated by the combination formula, and the second number is (1, the first number]. That is, there are multiple cases for the second number, so that the combination method is diverse, ensuring the comprehensiveness of all the obtained number of combinations, and improving the diversity and comprehensiveness of the obtained combined key.

[0030] Optionally, the method further includes:

[0031] The first target key and all the second target keys are stored locally.

[0032] According to the above description, the first target key and the second target key are stored locally to reduce dependence on the key management platform. At the same time, the first hash value is stored on the supervision platform to facilitate the supervision platform to monitor data decryption events related to the first hash value in real time and improve security.

[0033] Optionally, if not, decrypting all the second target keys using a combined key obtained by combining the first keys obtained according to the key request includes:

[0034] The key management platform that does not respond to the key request is regarded as an invalid platform, and the second target key associated with the invalid platform is deleted.

[0035] According to the above description, for a key management platform that does not respond, that is, an invalid platform, the second target key associated with it will be deleted to reduce resource usage.

[0036] Optionally, treating the key management platform that does not respond to the key request as an invalid platform includes:

[0037] An alarm is issued for the failed platform.

[0038] According to the above description, an alarm will be issued for a failed platform, so that the failed platform can be maintained in time.

[0039] In a second aspect, the present invention provides a data encryption and decryption system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a data encryption and decryption method described in the first aspect when executing the computer program.

[0040] Among them, the technical effects corresponding to the data encryption and decryption system provided by the second aspect refer to the relevant description of the data encryption and decryption method provided by the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a data encryption and decryption method provided in this embodiment;

[0042] Figure 2 A schematic diagram of the overall process of a data encryption and decryption method provided in this embodiment;

[0043] Figure 3 This is a structural diagram of a data encryption and decryption system provided by this embodiment.

[0044] [Description of Reference Numerals]

[0045] 1. A data encryption and decryption system;

[0046] 2. Processor;

[0047] 3. Memory. DETAILED DESCRIPTION

[0048] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0049] Example 1

[0050] When this embodiment is applied to a target device, the target device is used as a device for managing encrypted data. The first key of the key management platform is a highly complex key generated by the key management platform, and the key management platform provides a key transmission interface to the target device, and transmits the first key generated and managed by the key management through the interface. The first keys of multiple key management platforms are used to manage data on the target device. Compared with the solution of generating keys by the target device and storing them in the key management platform, the first key generated by the key management platform in this solution has higher complexity and security. In addition, this solution makes relatively small changes to the key management platform and is easy to implement.

[0051] The specific technical solution is discussed below.

[0052] Please refer to Figures 1 to 2 The present invention provides a method for data encryption and decryption, comprising the steps of:

[0053] S1. Obtain a dynamic original key, encrypt data to be encrypted using the dynamic original key to obtain encrypted data, perform a hash calculation on the dynamic original key to obtain a first hash value, and store the first hash value in a supervision platform;

[0054] In this embodiment, if Figure 2 As shown, the description is made with the central platform as the execution entity, that is, the central platform encrypts the data to be encrypted by obtaining the dynamic original key to obtain the encrypted data, performs hash calculation on the dynamic original key to obtain the first hash value, and stores the first hash value on the supervision platform.

[0055] At this time, before obtaining the dynamic original key in step S1, the following steps are included:

[0056] S10. Generate a dynamic original key in a trusted execution environment.

[0057] At this time, step S10 includes:

[0058] S101. Obtain a local physical key and generate a random number. Superimpose the physical key and the random number on the dynamic original key through an encryption algorithm to generate a new dynamic original key.

[0059] In this embodiment, if Figure 2 As shown, a dynamic original key is generated in a trusted execution environment, and a local physical key is obtained and a random number is generated. The physical key and the random number are superimposed on the dynamic original key through an encryption algorithm to generate a new dynamic original key.

[0060] S2. Obtain the first key of all key management platforms, encrypt the dynamic original key with all the first keys, and obtain the first target key; this solution can be applied to the target device (or central platform), which is used to manage encrypted data. The first key of the key management platform in this solution is a key with high complexity generated by the key management platform, and the key management platform of this solution provides a key transmission interface to the target device, and transmits the key generated and managed by the key management platform through the interface, and uses the keys of multiple key management platforms to manage data on the target device. Compared with the solution in which the target device generates the key and stores it in the key management platform, the key generated by the key management platform in this solution is more complex and more secure; in addition, this solution makes little change to the key management platform and is easy to implement.

[0061] At this time, the step S2 of encrypting the dynamic original key by all the first keys to obtain the first target key includes:

[0062] S21. Encrypt the dynamic original key in sequence using each first key to obtain a first target key;

[0063] In this embodiment, if Figure 2 As shown, the dynamic original key is encrypted in sequence through each first key. For example, there are key management platform 1, key management platform 2, key management platform 3, key management platform 4 and key management platform 5, and the corresponding first keys are: M1, M2, M3, M4 and M5 respectively. The dynamic original key is K1, then M1, M2, M3, M4 and M5 are used in sequence to encrypt K1 to obtain the first target key.

[0064] and / or

[0065] S22. Superimpose all the first keys using an encryption algorithm to generate a new first key, and encrypt the dynamic original key using the new first key to obtain a first target key;

[0066] In this embodiment, if Figure 2 As shown, all the first keys are superimposed by the encryption algorithm to generate a new first key, that is, M1, M2, M3, M4 and M5 are superimposed by the encryption algorithm to obtain a new first key, such as G1, and the dynamic original key K1 is encrypted by G1 to obtain the first target key.

[0067] and / or

[0068] S23. Encrypt all the first keys with each other using an encryption algorithm to obtain all encrypted first keys, and encrypt the dynamic original key using all the encrypted first keys to obtain all first target keys.

[0069] In this embodiment, if Figure 2 As shown, all first keys are encrypted with each other through the encryption algorithm, such as, M1 and M2 are encrypted, M1 and M3 are encrypted, M1 and M4 are encrypted, M1 and M5 are encrypted, M2 and M3 are encrypted, M2 and M4 are encrypted, M2 and M5 are encrypted, M3 and M4 are encrypted, M3 and M5 are encrypted, and M4 and M5 are encrypted to obtain all encrypted first keys, and the dynamic original key K1 is encrypted by the encrypted first key to obtain all first target keys.

[0070] S3. Select a first number of first keys from all the first keys to perform a second number of combinations to obtain all combined keys, and encrypt the dynamic original key using each combined key to obtain all second target keys;

[0071] In this embodiment, if Figure 2 As shown, a first number of first keys are selected from all first keys to perform a second number of combinations. At this time, the second number is (1, first number]. Assume that there are 5 key management platforms, namely, key management platform 1, key management platform 2, key management platform 3, key management platform 4 and key management platform 5, and the corresponding first keys are respectively: M1, M2, M3, M4 and M5, that is, there are 5 first keys. At this time, the first number is 4, that is, the second number is (1, 4). That is, 4 first keys are selected from the 5 first keys to perform two-by-two combinations, and / or three-by-three combinations, and / or four-by-four combinations to obtain all combined keys, and the dynamic original key is encrypted by each combined key to obtain all second target keys.

[0072] At this time, in step S3, a first number of first keys are selected from all the first keys to perform a second number of combinations, and all the combined keys obtained include:

[0073] S31. Substitute the first number and the second number into a combination formula to calculate all combination numbers, and obtain all combination keys based on all the combination numbers. The combination formula is:

[0074]

[0075] Wherein, P represents the number of all combinations, n represents the first number, and m represents the second number.

[0076] In this embodiment, if Figure 2 As shown, the first quantity and the second quantity are substituted into the combination formula for calculation to obtain all the combination quantities. For example, the first quantity is 4, and the first keys corresponding to the first quantity are: M1, M3, M4 and M5, and the second quantity takes the values ​​of 2, 3, and 4 respectively. When all the values ​​of the second quantity are taken into account, they are substituted into the combination formula with the first quantity for calculation. When the second quantity is 2, that is, when performing pairwise combinations, When the second number is 3, that is, when a three-three combination is performed, When the second number is 4, that is, when a four-four combination is performed, Then, the total number of combinations is: 6+4+1=11. Based on the total number of combinations, all the combination keys are obtained as follows:

[0077] Combined key 1: M1 and M3;

[0078] Combined key 2: M1 and M4;

[0079] Combined key 3: M1 and M5;

[0080] Combined key 4: M3 and M4;

[0081] Combined key 5: M3 and M5;

[0082] Combined key 6: M4 and M5;

[0083] Combined key 7: M1, M3 and M4;

[0084] Combined key 8: M1, M3 and M5;

[0085] Combined key 9: M1, M4 and M5;

[0086] Combined key 10: M3, M4, and M5;

[0087] Combined key 11: M1, M3, M4 and M5.

[0088] In this embodiment, the first target key obtained in step S2 and the second target key obtained in step S3 are both stored locally.

[0089] S4. When decrypting the encrypted data, a key request is sent to all the key management platforms to determine whether all the key requests are responded to. If so, the first target key is decrypted according to the first key obtained from all the key requests to obtain the decrypted target key. If not, all the second target keys are decrypted according to the combined key obtained by combining the first keys obtained from the key requests to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value and a verification request is sent to the regulatory platform to obtain the first hash value. It is determined whether the first hash value is the same as the second hash value. If so, the encrypted data is decrypted by the decrypted target key corresponding to the second hash value to obtain the original data.

[0090] In this embodiment, if Figure 2 As shown, when decrypting the encrypted data, the central platform sends a key request to all key management platforms, obtains the first target key and the second target key locally, and sends a request to the supervision platform to obtain the first hash value. It is determined whether all key requests are answered. If all are answered, the first target key is decrypted according to the first key obtained from all key requests to obtain the decrypted target key. If not all are answered, the first keys obtained from the key requests are combined to obtain a combined key, wherein the combination method used in the combination is the same as the combination method in step S2, so that the second target key is decrypted according to the obtained combined key to obtain the decrypted target key, the hash value of the decrypted target key is calculated to obtain the second hash value, and a verification request is sent to the supervision platform to obtain the first hash value. The supervision platform receives and agrees to the verification request before sending the first hash value back to the central platform. The central platform determines whether the first hash value and the second hash value are the same. If they are the same, it means that the decrypted target key corresponding to the second hash value can correctly decrypt the encrypted data to obtain the original data. If they are not the same, the correct original data cannot be obtained.

[0091] At this time, if no in step S4, decrypting all the second target keys using a combined key obtained by combining the first keys obtained by the key request includes:

[0092] S41: The key management platform that does not respond to the key request is regarded as an invalid platform.

[0093] In this embodiment, if Figure 2As shown, if all key requests are not responded to, the key management platform that has no response to the key request is regarded as an invalid platform, and the second target key associated with the invalid platform is deleted.

[0094] At this time, the step S41 of treating the key management platform that does not respond to the key request as an invalid platform includes:

[0095] S411: Issue an alarm to the failed platform.

[0096] In this embodiment, if Figure 2 As shown, an alarm will also be issued for the failed platform.

[0097] Example 2

[0098] Please refer to Figure 3 The present invention provides a data encryption and decryption system 1, comprising a memory 3, a processor 2, and a computer program stored in the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, the steps in the above-mentioned embodiment 1 are implemented.

[0099] Since the systems / devices described in the above embodiments of the present invention are systems / devices used to implement the methods of the above embodiments of the present invention, those skilled in the art will be able to understand the specific structures and variations of these systems / devices based on the methods described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the methods of the above embodiments of the present invention are within the scope of protection of the present invention.

[0100] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions.

[0102] It should be noted that, in the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims enumerating several means, several of these means may be embodied by one and the same hardware. The use of the words first, second, third etc. is for convenience only and does not indicate any order. These words may be understood as part of the component name.

[0103] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0104] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments after learning the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0105] Obviously, those skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if such modifications and variations fall within the scope of the claims and their equivalents, the present invention shall also include such modifications and variations.

Claims

1. A method for data encryption and decryption, characterized in that: include: Obtaining a dynamic original key, encrypting the data to be encrypted by using the dynamic original key to obtain encrypted data, performing a hash calculation on the dynamic original key to obtain a first hash value, and storing the first hash value in the supervision platform; Obtaining first keys of all key management platforms, and encrypting the dynamic original key using all the first keys to obtain a first target key; Select a first number of first keys from all the first keys to perform a second number of combinations to obtain all combined keys, and encrypt the dynamic original key using each combined key to obtain all second target keys; When decrypting the encrypted data, a key request is sent to all the key management platforms to determine whether all the key requests are responded to. If so, the first target key is decrypted according to the first key obtained from all the key requests to obtain the decrypted target key. If not, all the second target keys are decrypted according to the combined key obtained by combining the first keys obtained from the key requests to obtain the decrypted target key. The hash value of the decrypted target key is calculated to obtain the second hash value and a verification request is sent to the regulatory platform to obtain the first hash value. It is determined whether the first hash value is the same as the second hash value. If so, the encrypted data is decrypted by the decrypted target key corresponding to the second hash value to obtain the original data.

2. A method for data encryption and decryption as claimed in claim 1, characterized in that: The obtaining of the dynamic original key includes: Generate dynamic raw keys in a trusted execution environment.

3. A method for data encryption and decryption as claimed in claim 2, characterized in that: Generating a dynamic original key in a trusted execution environment includes: A local physical key is obtained and a random number is generated, and a new dynamic original key is generated by superimposing the physical key and the random number on the dynamic original key through an encryption algorithm.

4. A method for data encryption and decryption as claimed in claim 1, characterized in that: The step of encrypting the dynamic original key by using all the first keys to obtain the first target key comprises: The dynamic original key is encrypted in sequence by each first key to obtain a first target key; and / or All the first keys are superimposed by an encryption algorithm to generate a new first key, and the dynamic original key is encrypting by the new first key to obtain a first target key; and / or All the first keys are mutually encrypted by an encryption algorithm to obtain all encrypted first keys, and the dynamic original keys are encrypte d by all the encrypted first keys to obtain all first target keys.

5. A method for data encryption and decryption as claimed in claim 1, characterized in that: The selecting a first number of first keys from all the first keys to perform a second number of combinations to obtain all combined keys comprises: Substitute the first number and the second number into a combination formula for calculation to obtain all combination numbers, and obtain all combination keys according to all the combination numbers. The combination formula is: Wherein, P represents the number of all combinations, n represents the first number, and m represents the second number.

6. A method for data encryption and decryption as claimed in claim 1, characterized in that: The second number is (1, first number].

7. A method for data encryption and decryption as claimed in claim 1, characterized in that: Said also includes: The first target key and all the second target keys are stored locally.

8. A method for data encryption and decryption as claimed in claim 1, characterized in that: If not, decrypting all the second target keys using a combined key obtained by combining the first key obtained by the key request includes: The key management platform that does not respond to the key request is regarded as an invalid platform, and the second target key associated with the invalid platform is deleted.

9. A method for data encryption and decryption as claimed in claim 8, characterized in that: The step of treating the key management platform that has no response to the key request as an invalid platform includes: An alarm is issued for the failed platform.

10. A data encryption and decryption system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images